Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 06:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll
Resource
win7-20240215-en
4 signatures
150 seconds
General
-
Target
8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll
-
Size
214KB
-
MD5
8640a5f8e0a61fb9908e48ebd0084ebc
-
SHA1
5222e4b1507008ee4a58cabf9d5d42da84be825c
-
SHA256
19995a1dd05fd6d0479ccd9f268bf713a4e7d873a7c68c368343e59dd7b7cad6
-
SHA512
06dde8e24f006b55532e31faac8daaf7ac8c968934101c6c304183dfd6f1c3122889c75c8389def4cc6669e034f01aac87b9315b5699e58dde65d8f61df47376
-
SSDEEP
6144:54+U6Ou0hTIXJnxeecA9ikbl4yB6ETGzM0y:a+U6Oleh9cA/lV6ETGw0y
Malware Config
Extracted
Family
icedid
C2
ldrshekel.casa
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral2/memory/1736-1-0x0000000074EA0000-0x0000000074F37000-memory.dmp IcedidFirstLoader -
Program crash 1 IoCs
pid pid_target Process procid_target 4352 1736 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1736 1832 rundll32.exe 83 PID 1832 wrote to memory of 1736 1832 rundll32.exe 83 PID 1832 wrote to memory of 1736 1832 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8640a5f8e0a61fb9908e48ebd0084ebc_JaffaCakes118.dll,#12⤵PID:1736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 5963⤵
- Program crash
PID:4352
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1736 -ip 17361⤵PID:1360